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(54) SECURITY HOLE DIAGNOSTIC SYSTEM 
(57)Abstract: 

PROBLEM TO BE SOLVED: To provide inspection 
procedures capable of easily implementing an inspection. 
SOLUTION: This security hole diagnostic system is 
provided with an inspection implementing device 500 and 
an operation device 200. The inspection implementing 
device 500 is provided with a plurality of inspection 
implementing means 503 inspecting an inspection object 
host 104, an inspection implementing means storage 
section 504 storing a plurality of inspection implementing 
information defining the information of a plurality of 
inspection implementing means, and an implementation 
controller 501 controlling the implementation of a 
plurality of inspection implementing means and the 
interface with the operation device 200. The operation 
device 200 is provided with an operation controller 204 
controlling the interface with the inspection 
implementing device 500 and accepting the instructions 
inputted from a user, a procedure definition file 202 
storing the inspection procedures defining the inspection 
names indicating the inspections diagnosing a security hole with the inspection implementing 
means 503 according to the inspection sequence, and a screen generation section 201 
displaying an operation screen displaying the inspection names and the names of the inspection 
implementing means on a display. 
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* NOTICES ♦ 

Japan Patent Office is not responsible for any 
danages caused by the use of this translation. 

1 This document has been translated by computer. So the translation may not reflect the original precisely. 
2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



CLAIMS 



[Claim(s)] 

[Claim 1] The security hole diagnostic method characterized by providing the following. The operating set which 
receives the directions inputted by the user based on the screen which carries out display and is displayed 
on a display They are two or more inspection activation means by which the above-mentioned inspection 
activation equipment inspects equipment to be examined in the security hole diagnostic method equipped with 
the inspection activation equipment which performs inspection to the equipment to be examined which diagnoses 
a security hole. Two or more inspection execution information which two or more above-mentioned inspection 
activation means of each are made to correspond, and defines information including the inspection activation 
means name which shows two or more above-mentioned inspection activation means of each The inspection 
activation means storing section which matches and stores two or more above-mentioned inspection activation 
means, It has the execution control section which controls activation of two or more above-mentioned 
inspection activation means, and controls an interface with the above-mentioned operating set. The above- 
mentioned operating set The actuation control section which receives the directions which control an interface 
with the above-mentioned inspection activation equipment, and are inputted by the user, The procedure 
definition file which memorizes the inspection routine which defines the inspection name which shows inspection 
which diagnoses a security hole using the above-mentioned inspection activation means according to the 
sequence to inspect, From the above-mentioned procedure definition file, read inspection routine and it is based 
on the read inspection routine. The screen generation section acquire inspection execution information from the 
above-mentioned inspection activation means storing section through the above-mentioned actuation control 
section, generate the actuation screen which displays an inspection name and an inspection activation means 
name based on the above-mentioned inspection routine and the acquired inspection execution information, and 
display the generated actuation screen to the above-mentioned display 

[Claim 2] The detailed information corresponding to each is memorized, the inspection name of plurality [ file / 
above-mentioned / procedure definition ] as inspection routine, and two or more above-mentioned inspection 
names — the above-mentioned screen generation section From the above-mentioned procedure definition file, 
inspection routine is read and the actuation screen which displays two or more inspection names included in the 
read inspection routine is generated. The above-mentioned actuation control section The input of the inspection 
name chosen by the user among two or more inspection names displayed on the actuation screen is received, 
and the received inspection name is notified to the above-mentioned screen generation section. The above- 
mentioned screen generation section The security hole diagnostic method according to claim 1 which inputs the 
above-mentioned inspection name notified from the above-mentioned actuation control section, reads the 
detailed information corresponding to the inputted inspection name from the above-mentioned inspection routine 
file, and is characterized by generating the actuation screen which displays the read detailed information. 
[Claim 3] The above-mentioned inspection execution information is a security hole diagnostic method according 
to claim 1 or 2 characterized by for the above-mentioned screen generation section making the inspection name 
which extracted the inspection name included in the acquired inspection execution information, and was 
extracted, and a corresponding inspection activation means name correspond, and generating an actuation 
screen including an inspection name. 

[Claim 4] The above-mentioned inspection execution information contains an executable parameter required for 
activation of an inspection activation means. The above-mentioned actuation screen It matches with the above- 
mentioned inspection name and an inspection activation means name, and the procedure viewing area to display 
and the inspection parameter area which displays the above-mentioned executable parameter are included. The 
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above--mentioned actuation control section The input of the inspection activation means name chosen by the 
user is received, and the received inspection activation means name is notified to the above-mentioned screen 
generation section. The above-mentioned screen generation section The inspection activation means name 
notified from the above-mentioned actuation control section is inputted, and the above-mentioned actuation 
control section is minded. From the inspection activation means storing section of the above-mentioned 
inspection activation equipment The inspection execution information corresponding to the inspection activation 
means which the inputted inspection activation means name shows is acquired, claims 1 -3 which extract an 
executable parameter and are characterized by generating the actuation screen which displays the extracted 
executable parameter on an inspection parameter area from the acquired inspection execution information — a 
security hole diagnostic method given in either 

[Claim 5] It is the security hole diagnostic method according to claim 4 which outputs the executable parameter 
which received the executable parameter into which the above-mentioned actuation control section was 
inputted by the user including the input area where the above-mentioned inspection parameter area receives the 
input of an executable parameter, and was received to the above-mentioned execution-control section, and 
carries out [ performing an inspection activation means and ] as the description using the executable parameter 
which the above-mentioned execution-control section inputted the executable parameter from the above- 
mentioned actuation control section, and inputted. 

[Claim 6] Inspection which diagnoses the above-mentioned security hole is performed using two or more 
inspection activation means. The above-mentioned inspection name It is matched with two or more inspection 
activation means names. The above-mentioned inspection execution information The run number which shows to 
what position of two or more inspection activation means used for inspection it performs is included. The above- 
mentioned screen generation section Two or more inspection execution information containing each is acquired, 
two or more inspection activation means names matched with the above-mentioned inspection name — Two or 
more inspection activation means names and two or more run numbers are extracted from two or more acquired 
inspection execution information of each. The security hole diagnostic method according to claim 5 
characterized by generating the actuation screen which displays the above-mentioned inspection name and two 
or more extracted inspection activation means names on a procedure viewing area based on two or more 
extracted run numbers of each. 

[Claim 7] The above-mentioned screen generation section is the security hole diagnostic method according to 
claim 6 which generates the executable parameter contained in two or more inspection execution information of 
each corresponding to the inspection name performed among the executable parameters which extracted the 
executable parameter and were extracted as a procedure parameter from two or more acquired inspection 
execution information of each, and is characterized by to generate the actuation screen which displays the 
generated procedure parameter on the above-mentioned procedure parameter area. 

[Claim 8] The above-mentioned actuation control section receives the input of the inspection activation means 
name chosen by the user among two or more above-mentioned inspection activation means names. The 
received inspection activation means name is outputted to the above-mentioned screen generation section. The 
above-mentioned screen generation section The security hole diagnostic method according to claim 6 which 
inputs the above-mentioned inspection activation means name, and is characterized by generating the actuation 
screen which displays the executable parameter corresponding to the inputted inspection activation means name 
on an inspection parameter area from the above-mentioned actuation control section. 
[Claim 9] From equipment to be examined, the above-mentioned execution control section acquires an 
inspection activation result, and writes the acquired inspection activation result in inspection execution 
information. The inspection execution information which wrote in the inspection activation result through the 
above-mentioned execution control section is outputted to the above-mentioned actuation control section. The 
above-mentioned actuation control section The inspection execution information outputted from the above- 
mentioned execution control section is inputted, and the inspection activation result included in the inputted 
inspection execution information is notified to the above-mentioned screen generation section. The above- 
mentioned screen generation section The security hole diagnostic method according to claim 6 which inputs the 
notified inspection activation result and is characterized by generating the actuation screen displayed on an 
inspection parameter area by making the inputted inspection activation result into the above-mentioned 
executable parameter. 

[Claim 10] The above-mentioned execution control section acquires the activation situation of inspection which 
a security hole diagnoses using an inspection activation means from equipment to be examined. The activation 
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situation of acquired inspection is outputted to an actuation control section. The above-mentioned actuation 
control section The activation situation of inspection outputted from the above-mentioned execution control 
section is inputted, and the activation situation of inspection of having inputted is notified to the above- 
mentioned screen generation section. The above-mentioned screen generation section The security hole 
diagnostic method according to claim 1 which acquires the activation situation of inspection notified from the 
above-mentioned actuation control section, generates the inspection result display screen which displays the 
acquired activation situation of inspection, and is characterized by displaying the generated inspection result 
display screen on the above-mentioned display. 



[Translation done.] 
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Japan Patent Office is not responsible for any 
damages caused by the use of this translation. 
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DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention] This invention relates to the system which diagnoses the existence of the security hole 

of a computer. 

[0002] 

[Description of the Prior Art] Conventionally, it is Internet as a diagnostic tool of a comprehensive security hole. 
Security Internet of Systems It is free and Scanner and nessus currently exhibited are mentioned. These have 
the database of a known security hole and have the function to inspect the existence of a security hole from the 
exterior to a host to be examined. 

[0003] It is [ nmap and ] John as a tool which inspects a security hole by actually attacking on the other hand, 
the The tool called ripper exists, nmap is a tool for specifying the service which is working on a candidate host, 
and is John, the ripper is a tool which detects the account which had a password brittle as an input for the 
password file. 
[0004] 

[Problem(s) to be Solved by the Invention] However, it is only that the above comprehensive security hole 
diagnostic tools check existence of the security hole of a host to be examined, and what kind of unlawful access 
does not judge by the possible furnace further using the security hole. Therefore, even if the manager 
discovered the security hole on the computer put under management using the above-mentioned tool, to what 
extent it may have been invaded in the past had the trouble that it had to depend on a manager's knowledge and 
experience. 

[0005] as mentioned above, it may be invaded to what extent — becoming an effective attack, if the existing 
attack tool is only what realized the single function and they are used in what kind of procedure although that 
inspection actually needs to attack — moreover, how the information acquired with a certain tool should be 
applied with other tools had the large part depending on a user's workmanship. 

[0006] This invention is the integrative security hole diagnostic tool which made it possible to be made in order 
to cancel the above-mentioned trouble, to prepare two or more inspection of a single function, to classify them 
according to the inspection routine considered to be effective with it being general, and to reuse each inspection 
result automatically to other inspection. 
[0007] 

[Means for Solving the Problem] The security hole diagnostic method concerning this invention The operating 
set which receives the directions inputted by the user based on the screen which carries out display and is 
displayed on a display. In the security hole diagnostic method equipped with the inspection activation equipment 
which performs inspection to the equipment to be examined which diagnoses a security hole the above- 
mentioned inspection activation equipment Two or more inspection execution information which two or more 
above-mentioned inspection activation means of each are made to correspond, and defines information including 
the inspection activation means name which shows two or more inspection activation means to inspect 
equipment to be examined, and two or more above-mentioned inspection activation means of each. The 
inspection activation means storing section which matches and stores two or more above-mentioned inspection 
activation means. It has the execution control section which controls activation of two or more above- 
mentioned inspection activation means, and controls an interface with the above-mentioned operating set. The 
above-mentioned operating set The actuation control section which receives the directions which control an 
interface with the above-mentioned inspection activation equipment, and are inputted by the user, The 



http://www4.ipdl jpo.go.jp/cgi-bin/tran,web_cgi.ejje 



2004/09/15 



2/9 /<— i? 

' ' • • 

procedure definition file which memorizes the inspection routine which defines the inspection name which shows 
inspection which diagnoses a security hole using the above-mentioned inspection activation means according to 
the sequence to inspect. From the above-mentioned procedure definition file, read inspection routine and it is 
based on the read inspection routine. Inspection execution information is acquired from the above-mentioned 
inspection activation means storing section through the above-mentioned actuation control section. Based on 
the above-mentioned inspection routine and the acquired inspection execution information, the actuation screen 
which displays an inspection name and an inspection activation means name is generated, and it is characterized 
by having the screen generation section which displays the generated actuation screen on the above-mentioned 
display. 

[0008] The detailed information corresponding to each is memorized, the inspection name of plurality [ file / 
above-mentioned / procedure definition ] as inspection routine, and two or more above-mentioned inspection 
names — the above-mentioned screen generation section From the above-mentioned procedure definition file, 
inspection routine is read and the actuation screen which displays two or more inspection names included in the 
read inspection routine is generated. The above-mentioned actuation control section The input of the inspection 
name chosen by the user among two or more inspection names displayed on the actuation screen is received, 
and the received inspection name is notified to the above-mentioned screen generation section. The above- 
mentioned screen generation section The above-mentioned inspection name notified from the above-mentioned 
actuation control section is inputted, and the detailed information corresponding to the inputted inspection name 
is read from the above-mentioned inspection routine file, and it is characterized by generating the actuation 
screen which displays the read detailed information. 

[0009] It is characterized by for the above-mentioned inspection execution information making the inspection 
name which the above-mentioned screen generation section extracted the inspection name included in the 
acquired inspection execution information, and was extracted including the inspection name, and a corresponding 
inspection activation means name correspond, and generating an actuation screen. 

[0010] The above-mentioned inspection execution information contains an executable parameter required for 
activation of an inspection activation means. The above-mentioned actuation screen It matches with the above- 
mentioned inspection name and an inspection activation means name, and the procedure viewing area to display 
and the inspection parameter area which displays the above-mentioned executable parameter are included. The 
above-mentioned actuation control section The input of the inspection activation means name chosen by the 
user is received, and the received inspection activation means name is notified to the above-mentioned screen 
generation section. The above-mentioned screen generation section The inspection activation means name 
notified from the above-mentioned actuation control section is inputted, and the above-mentioned actuation 
control section is minded. From the inspection activation means storing section of the above-mentioned 
inspection activation equipment The inspection execution information corresponding to the inspection activation 
means which the inputted inspection activation means name shows is acquired, and from the acquired inspection 
execution information, an executable parameter is extracted and it is characterized by generating the actuation 
screen which displays the extracted executable parameter on an inspection parameter area. 
[001 1] Including the input area where the above-mentioned inspection parameter area receives the input of an 
executable parameter, the executable parameter into which the above-mentioned actuation control section was 
inputted by the user is received, and the received executable parameter is outputted to the above-mentioned 
execution control section, and it carries out [ that the above-mentioned execution control section performs an 
inspection activation means using the executable parameter which inputted and inputted the executable 
parameter from the above-mentioned actuation control section, and ] as the description. 

[0012] Inspection which diagnoses the above-mentioned security hole is performed using two or more inspection 
activation means. The above-mentioned inspection name It is matched with two or more inspection activation 
means names. The above-mentioned inspection execution information The run number which shows to what 
position of two or more inspection activation means used for inspection it performs is included. The above- 
mentioned screen generation section Two or more inspection execution information containing each is acquired, 
two or more inspection activation means names matched with the above-mentioned inspection name — From 
two or more acquired inspection execution information of each, two or more inspection activation means names 
and two or more run numbers are extracted, and it is characterized by generating the actuation screen which 
displays two or more inspection activation means names extracted with the above-mentioned inspection name 
based on two or more extracted run numbers of each on a procedure viewing area. 

[0013] The above-mentioned screen generation section generates the executable parameter contained in two or 
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more inspection execution information of each corresponding to the inspection name performed among the 
executable parameters which extracted the executable parameter and were extracted as a procedure parameter 
from two or more acquired inspection execution information of each, and is characterized by generating the 
actuation screen which displays the generated procedure parameter on the above-mentioned procedure 
parameter area. 

[0014] The above-mentioned actuation control section receives the input of the inspection activation means 
name chosen by the user among two or more above-mentioned inspection activation means names. The 
received inspection activation means name is outputted to the above-mentioned screen generation section, and 
the above-mentioned screen generation section carries out generating the actuation screen which displays the 
executable parameter corresponding to the inspection activation means name which inputted and inputted the 
above-mentioned inspection activation means name on an inspection parameter area from the above-mentioned 
actuation control section as the description. 

[0015] From equipment to be examined, the above-mentioned execution control section acquires an inspection 
activation result, and writes the acquired inspection activation result in inspection execution information. The 
inspection execution information which wrote in the inspection activation result through the above-mentioned 
execution control section is outputted to the above-mentioned actuation control section. The above-mentioned 
actuation control section The inspection execution information outputted from the above-mentioned execution 
control section is inputted, and the inspection activation result included in the inputted inspection execution 
information is notified to the above-mentioned screen generation section. The above-mentioned screen 
generation section The notified inspection activation result is inputted and it is characterized by generating the 
actuation screen displayed on an inspection parameter area by making the inputted inspection activation result 
into the above-mentioned executable parameter. 

[0016] The above-mentioned execution control section acquires the activation situation of inspection which a 
security hole diagnoses using an inspection activation means from equipment to be examined. The activation 
situation of acquired inspection is outputted to an actuation control section. The above-mentioned actuation 
control section The activation situation of inspection outputted from the above-mentioned execution control 
section is inputted, and the activation situation of inspection of having inputted is notified to the above- 
mentioned screen generation section. The above-mentioned screen generation section The activation situation 
of inspection notified from the above-mentioned actuation control section is acquired, and the inspection result 
display screen which displays the acquired activation situation of inspection is generated, and it is characterized 
by displaying the generated inspection result display screen on the above-mentioned display. 
[0017] 

[Embodiment of the Invention] Actuation of the gestalt of this operation is described below gestalt 1 . of 
operation, referring to drawing. First, system-wide actuation is explained, referring to dravying 1 . This system is 
delivering a false attack through a network 103 to the host 104 to be examined, and detects the security hole 
which exists in the host (equipment to be examined) 104 to be examined. 

[0018] This system consists of an operating set 200 and inspection activation equipment 500, and the activation 
result of inspection by which an inspection demand is returned to a user by inspection activation equipment 500 
from delivery and inspection activation equipment 500 through an operating set 200 is displayed on an operating 
set 200. 

[0019] Next, an example of the configuration of inspection activation equipment 500 is explained, referring to 
drawing 2 . Inspection activation equipment 500 consists of the execution control section 501, the candidate 
host information storing section 502, an inspection activation means 503, and the inspection activation means 
storing section 504. 

[0020] The execution control section 501 controls the inspection activation equipment 500 whole according to 
the demand from an operating set 200. Each false attack is mounted on the inspection activation means 503. 
The inspection activation means 503 is stored in the inspection activation means storing section 504. If needed, 
the inspection activation means 503 is loaded by the execution control section 501 on memory, and delivers a 
false attack by it. 

[0021] The candidate host information storing section 502 is for enabling it to use as information at the time of 
storing the information about the host 1 04 to be examined obtained from the false attack, and delivering another 
false attack from an operating set 200. If an example is given, the IP address of a host to be examined is stored 
from an operating set 200, or port information on the candidate host acquired by the port scan false attack is 
stored. They are referred by another inspection activation means. 
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[0022] Moreover, the inspection activation means storing section 504 is combined, and stores the information 
corresponding to an inspection activation means as information on an inspection activation means (inspection 
execution information) while it stores two or more inspection activation means 503. The information on an 
inspection activation means may be recorded on the interior of the inspection activation means 503. 
[0023] The information on an inspection activation means is matched with the inspection activation means 503. 
and should just be stored in the above-mentioned inspection activation means storing section. Therefore, even 
when recorded on the interior of the inspection activation means 503, the case where it exists as a separate file 
is sufficient. The following explanation explains the case where the information on an inspection activation 
means is recorded on the interior of the inspection activation means 503. 

[0024] Next, an operating set 200 is explained, referring to draw ing 3 . An operating set 200 is equipped with the 
screen generation section 201. the procedure definition file 202, the display name definition file 203, the 
actuation control section 204. and a display 205. The actuation control section 204 controls an interface with 
inspection activation equipment, and receives the directions inputted by the user. In addition, the actuation 
control section 204 controls the operating set 200 whole. The procedure definition file 202 is defined according 
to the sequence of inspecting the inspection routine of a security hole diagnosis. 

[0025] The actuation screen which displays inspection routine as the information on the inspection activation 
means which acquired and acquired the information inspection execution information (inspection execution 
information) of the inspection activation means storing section 504 to an inspection-routine means based on 
inspection routine generates through an actuation control section 204 from a procedure definition file 202 based 
on the inspection routine which read inspection routine and read, and the screen generation section 201 displays 
the actuation screen generated to the above-mentioned display 205. 

[0026] An operating set 200 provides a user with an actuation means with an actuation screen. The actuation 
screen control section 204 reads the procedure definition file 202 and the display name definition file 203 at the 
time of starting, and performs required initialization at it. 

[0027] The procedure definition file 202 describes the Ruhr for classifying an inspection activation means for the 
extra information (an execution condition, detail explanation) of a routine name and a procedure, and each 
procedure, and defines general attack procedures, such as "port scan" and "file acquisition", as them as 
inspection routine ("inspection routine" is also hereafter called "procedure"). At the time of operating set 
starting, the inspection activation means belonging to each inspection routine is searched and sorted, and is 
displayed on a screen. Drawin g 4 shows an example of the format of the procedure definition file 202 of the 
gestalt of this operation. 

[0028] The display name definition file 203 is a dictionary for changing into the word of each country the 
character string displayed on a screen. Drawing 5 shows an example of the format of the display name definition 
file 203 of the gestalt of this operation. 

[0029] An example of an actuation screen is shown in drawing 8 from drawing 6 . Dr awin g 6 shows an example of 
the main screen (actuation screen) 301. The main screen 301 is equipped with the procedure viewing area 401 
which displays inspection routine, and the inspection parameter area 402 used with the inspection activation 
means 503. Drawin g 7 shows an example of the candidate host information input screen 302. Drawing 8 shows an 
example of the inspection result display screen 303. 

[0030] The procedure viewing area 401 displays the "inspection routine" which can be performed by this system 
as a node of a tree, and displays the inspection activation means name corresponding to "inspection routine" 
as the subnode further. 

[0031] The inspection parameter area 402 is generated corresponding to the "inspection routine" or the 
inspection activation means name chosen on the procedure viewing area 401, and displays the screen for 
inputting a parameter required in order to perform the selected procedure or inspection. 
[0032] Display and elimination of these actuation screens are done if needed. The candidate host information 
input screen 302 is a screen for performing display and edit of the information stored in the candidate host 
information storing section 502 in inspection activation equipment 500. A user specifies the equipment inspected 
using the candidate host information input screen 302. The inspection result display screen 303 is a screen 
which displays the activation result of inspection. 

[0033] The operating instructions of this operating set 200 are described briefly. A user's starting of an 
operating set 200 displays the main screen 301 shown in drawin g 6 . The node (procedure node) showing 
inspection routine of inspection routine is displayed on the procedure viewing area 401. Moreover, the inspection 
activation means name (node of an inspection activation means) classified into each procedure is displayed as 
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the subnode. 

[0034] The parameter input screen where he corresponded when the user chose the node (procedure node) of 
inspection routine or the node of an inspection activation means is generated on the inspection parameter area 
402. This expresses the input item of the execution-time parameter which a user has to give, in order to perfomr 
inspection corresponding to the selected node. When a procedure node is chosen, all parameters required in 
order to perform all the inspection activation means 503 classified into the inspection routine are displayed. 
[0035] Only it is performed when it inspects, where the node of an inspection activation means is chosen. Where 
a procedure node is chosen, when it inspects, an inspection activation means to belong to the selected 
procedure node as a subnode is performed in order. An activation result can be checked in the inspection result 
display screen 303. 

[0036] the case where it inspects by choosing a procedure node — the property top of the inspection routine — 
" — even [ either ] — also coming out — " thing which should be just successful, and what "it is better to 
perform all" can be considered. For example, if at least one procedure of an inspection activation means to 
connote of "file acquisition" is successful, the purpose can be attained, but in the case of "port scan", a result 
can be maximized when all inspection activation means to connote are performed. 

[0037] When a procedure node is chosen, he is trying to express the radio button for activation terminating 
condition selection as the gestalt of this operation on the inspection parameter area 402, in order that a user 
may enable it to control these. A radio button can be chosen from three kinds, "it is an inquiry to a user". 
[ "ending, when it succeeds"; "performing all", and ] A user chooses [ above-mentioned ] one from three kinds. 
[0038] Drawing 9 is drawing showing the method of presentation of the running state of the inspection activation 
means in an actuation screen. A user is notified of the activation situation of inspection by displaying the icon 
expressed with drawjng 9 on the node in the corresponding procedure viewing area 401. 

[0039] As a result of inspection, a "password file" may be able to be acquired or account and a password may 
become clear. Next, when the inspection routine which needs them as an input parameter, or an inspection 
activation means is chosen, the they-acquired data are set to GUI for parameter inputs in the inspection 
parameter area 402 as a default. 

[0040] Next, actuation of this system is explained. First, the processing at the time of starting is explained, 
referring to drawin g 1 0 . drawing 1 1 , and drawing 12 . The processing at the time of starting is roughly classified 
into three. They are an information reading phase, a procedure parameter generation phase, and a screen-display 
phase: 

[0041] Drawing 10 is a flow chart which shows the classification procedure (information reading phase) of the 
inspection activation means in an actuation screen. Drawin g 1 1 is a flow chart which shows the initialization 
procedure (procedure parameter generation phase) of the inspection routine information at the time of 
initialization. Drawing 1 2 is a flow chart which shows the initial-screen construction procedure (screen-display 
phase) in the procedure viewing area 401 in an actuation screen. Hereafter, order is explained later on. 
[0042] Drawin g 1 0 is a flow chart showing an information reading phase. A system reads the procedure definition 
file 202 by 801 at the time of a system startup. The procedure definition file is carrying out the format as shown 
by drawin g 4 , and consists of a sort key name and a list of procedure definition entries (a key value, a category 
name (procedure display name), an activation terminating condition, detail explanation). 

[0043] By drawin g 4 , the sort key name shows PLUGIN_TYPE as an example. Moreover, the procedure definition 
entry is described by the format of <key vaiue> = <category name (procedure display name)> ¥<activation 
terminating condition >¥ <detail explanation> in drawin g 4 . 

[0044] An example of the configuration of a procedure definition file is shown in drawing 13 . The procedure 
definition entry expressed as the sort key name as "key value = classification place category information" is 
included in a procedure definition file as mentioned above. The parts of a category name (procedure display 
name), an activation terminating condition, and detail explanation of classification place category information 
correspond. 

[0045] The operation of a category name, an activation terminating condition, and detail explanation is shown in 

drawing 13 . 

[0046] Next, the procedure data dictionary (Map) which can be searched with a key value is generated from the 
read list of procedure definition entries by 802. The data stored in Map are the structure with the element of (a 
procedure display name (category name), an activation terminating condition, procedure explanation (detail 
explanation of a procedure definition entry), the list of inspection activation means information, and a procedure 
parameter). The list and procedure parameter of inspection activation means information are empty in this 
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phase. 

[0047] By 803-809, the information on all the inspection activation means 503 to the inspection activation 
means stored in the inspection activation means storing section 504 of inspection activation equipment 500 is 
acquired. The information on the acquired inspection activation means searches a sort key name as a property 
name, and acquires a key value as a searched result. Map is searched with the acquired key value and it 
registers with the list of the inspection activation means information in the corresponding procedure data. 
[0048] First, the screen generation section 201 reads a procedure definition file, and acquires a sort key name 
(for example, the procedure definition file of drawi ng 4 "PLUGIN_TYPE"). Next, the screen generation section 
201 reads the inspection activation means 503 stored in the inspection activation means storing section 504 of 
inspection activation equipment 500 through the actuation control section 204, and acquires the information on 
an inspection activation means. Relation with the information on the inspection activation means 503 and an 
inspection activation means is shown in drawing 14 . 

[0049] Next, the screen generation section 201 acquires the value of the data applicable to a sort key name 
(here "PLUGIN_TYPE") from the information on the acquired inspection activation means. Signs that the value 
of data is acquired to drawing 15 are shown. Here, the value of the acquired data supports the key value in the 
procedure definition file 202. . 
[0050] Based on the taken-out value (here "PASSWORD.CRACK"). the classification place category which 
corresponds within the procedure definition file 202 is searched. An inspection activation means node is 
generated as a child node of the node on the screen corresponding to the corresponding classification place 
category. The activation inspection name ("NAME") property (in the case of drawing 15 , it is "john") of the 
information on an inspection activation means is used for the identifier of the node to generate. 
[0051] It carries out about all inspection activation means by which the process of 2-5 is saved. 
[0052] The information on an inspection activation means is the list of the data which make a property name, 
data type, and a value one entry, as shown in drawing 15 . Two or more these lists exist. It is possible to make a 
list nest a value further. The information on an inspection activation means contains two properties, an 
activation inspection name (a property name is "NAME") (string type) and an activation parameter list (a 
property name is "PARAMETER") (list-directed), at least. 

[0053] The attribute of others which are contained in the information on an inspection activation means can be 
added to arbitration for every inspection activation means. Each attribute is identified by the property name. The 
information on an inspection activation means contains the run number which shows whether it is an inspection 
activation means to perform to what position among two or more inspection activation means to correspond to 
the key value of 1 . 

[0054] Drawing 16 shows an example of the activation parameter list contained in the information on an 
inspection activation means. The part applicable to the activation parameter list of the information on an 
inspection activation means makes a property name "PARAMETER". An activation parameter list is a list of the 
data which make a parameter name, data type, and a default one entry. 

[0055] An executable parameter specifies the parameter which must be given to an inspection activation means, 
when performing an inspection activation means. A default is a value used when a parameter should carry out 
and it carries out. Moreovier, when there is a value of a parameter except tolerance or errors of a parameter, 
such as an insufficient ****** case, occur [ a parameter ], the message which warns a user of an error is 
displayed at the time of inspection activation, and the input of a parameter is urged to it. The activation 
parameter list in the information on the above-mentioned inspection activation means is a list of the data which 
make a parameter name, data type, and a default one entry. 

[0056] Next, processing of a procedure parameter generation phase is explained, referring to drawing 1 1 . The 
purpose of this phase is generating a parameter list which connotes all the activation parameter lists contained 
in the inspection activation means information belonging to ** "inspection routine", and registering it as a 
procedure parameter in procedure data. 

[0057] The flow chart expressed with drawing 1 1 consists of two nested loop formations. One is a loop formation 
expressed with 1002-101 1, and this means that 1003-1009 are performed over all the procedure data in Map. 
Another is a loop formation expressed with 1006-1009, and this means that 1007-1008 are performed over all 
the inspection activation means information registered into the inspection activation means information list of 
[ in each procedure data ]. 

[0058] All the activation parameter lists acquired by 1007 are compounded by 1008, and the final result is 1010 
and they are registered as a procedure parameter in procedure data. The intermediate result Pt and the 
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activation parameter list (paramjist) acquired by 1007 are compared with the composition carried out by 1008. 
and when an entry with the parameter name which does not exist in Pt exists in paramjist, it realizes by adding 
the entry to Pt. 

[0059] The procedure parameter generated by the above-mentioned processing expresses the parameter list 
indispensable to perform all the inspection activation means included in the "inspection routine." 
[0060] Next, processing of a screen-display phase is explained, referring to drawing 1 2 . The flow chart 
expressed with drawing 12 consists of two nested loop formations. An outside loop formation is a loop formation 
expressed with 1 102-1 111. Over all the procedure data in Map, this generates a node on the procedure viewing 
area 401, further, is executing loop formations 1106-1110 in the interior, and generates the node corresponding 
to the inspection activation means registered into each procedure data as a subnode of a procedure node. The 
information on procedure data or an inspection activation means is related with each generated node. The above 
is explanation about the processing at the time of this system startup. 

[0061] Next, generation processing of the inspection parameter area 402 when a user clicks the node on the 
procedure viewing area 401 is explained. Drawing. 17 and drawing 18 are the flow charts showing generation 
processing of the inspection parameter area 402 at the time of clicking the node (procedure node) to which a 
user expresses the inspection routine on the procedure viewing area 401. All the contents currently displayed by 
then are eliminated in a procedure 1201. Next, it acquires based on the node which had the procedure data D 
("the procedure data D" is hereafter called "D") related with the node by the screen generation phase of 
processing in the first half at the time of starting clicked (procedure 1202). Next, detail explanation is taken out 
from D and it displays on the inspection parameter area 402 (procedure 1 203). 

[0062] Next, the radio button with which an activation terminating condition is expressed on a screen is 
generated, and the radio button corresponding to the activation terminating condition registered by D is changed 
into a selection condition (procedure 1 204). the gestalt of this operation — as an activation terminating 
condition — " — even — also coming out — if it succeeds — termination" and "performing all" — " — if it 
succeeds, three kinds of inquiry" will be prepared for the user. 

[0063] Next, the procedure parameter list P ("the procedure parameter list P" is hereafter called "P") is 
acquired from D (procedure 1205), and the input screen which corresponds by loop formations 1207-1215 is 
displayed on the inspection parameter area 402 to each parameter entry in P. 

[0064] By loop formations 1207-1215, it processes as follows. The i-th element of P will be expressed as P [i]. 
First, a parameter name is acquired from P [i] in a procedure 1 208, and it displays on the inspection parameter 
area 402. At this time, a display name is changed into intelligible language according to the contents of the 
display name definition file 203 read at the time of starting. Next, the data type of P [i] is estimated by the 
procedure 1 209, and processing branches by the result. 

[0065] When data type is a character string or a numeric value, a text box is displayed on the bottom of the 
parameter name which displayed the point (procedure 1210). The default set as P [i] is displayed on a text box 
(procedure 121 1). 

[0066] When data type is binary, the text box which inputs the pathname of the file by which binary data were 
stored under the parameter name is displayed (procedure 1212). Next, "reference" carbon button which displays 
the dialog for choosing the file in which binary data are stored beside the parameter name is generated 
(procedure 1213). Finally, a default is taken out from P [i] and it sets to a text box (procedure 1214). 
[0067] An example of the screen generated by the above processing is the inspection parameter area 402 in 
drawing 19 . Drawing 19 also shows the source of the data currently displayed. 

[0068] Drawing 20 and drawin g 21 are the flow charts showing generation processing of the inspection parameter 
area 402 at the time of clicking the node (node of an inspection activation means) to which a user expresses the 
inspection activation means on the procedure viewing area 401. All the contents currently displayed by then are 
eliminated in a procedure 1301. Next, it acquires based on the node which had the inspection activation means 
information D ("the inspection activation means information D" is hereafter called "D") related with the node by 
the screen generation phase of processing in the first half at the time of starting clicked (procedure 1 302). Next, 
detail explanation is taken out from D and it displays on the inspection parameter area 402 (procedure 1 303). 
[0069] When the node of the inspection activation means of "sendmail.vuln" is chosen as draw in g 22 , the 
example of a screen of the phase where detail explanation was displayed is shown. Next, the actuation which 
sets up an activation parameter list is explained. 

[0070] Next, the activation parameter list Pm of an inspection activation means is acquired from D (procedure 
1 304). and the procedure parameter P ("the procedure parameter P" is hereafter called "P") is acquired from 
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the procedure information related with the parent node of the node clicked further (procedure 1305). 
[0071] Hereafter, the procedures 1307-1314 as well as procedures 1207-1214 are processed. By processing 
1315, it inspects whether the parameter of the parameter name of P [i] and a same name exists in Pm. If it does 
not exist, since it is the parameter of input needlessness, the item makes the input of displayed GUI improper 
with this inspection activation means (procedure 1317). 

[0072] An example of the screen generated by the above processing is an inspection parameter area in dravying 
23 . In drawing 22 and dr awin g 23 Jt is a field [ that a "GUI storing directory name" cannot input ]. Moreover, an 
example which generates the inspection parameter area at the time of procedure node selection to d rawing 24 is 
shown. Moreover, an example which generates the inspection parameter area at the time of node selection of an 
inspection activation means to drawin g 25 is shown. 

[0073] As shown in drawing, a procedure parameter is a list of executable parameters needed in order to 
perform all the inspection activation means belonging to inspection routine. A procedure parameter is generated 
by taking the sum-set of the activation parameter list (an example is shown in drawin g 16 ) contained in the 
information on an inspection activation means. Moreover, when the node of an inspection activation means is 
chosen, as shown in drawing 25 , the input only of the activation parameter list contained in the information on 
the inspection activation means matched with the inspection activation means is enabled, or a default is 
displayed. 

[0074] The processing made into the default of the input parameter of other inspection of an inspection 
activation result is explained to the last, referring to drawin g 26 and d rawin g 27 . With the gestalt of this 
operation, an inspection result returns the list which makes (a data name, data type, and a value) one entry as 
acquired data besides a success and failure. An operating set acquires an inspection result R ("an inspection 
result R" is hereafter called "R") from inspection activation equipment after performing inspection by 1501 
(procedure 1502). 

[0075] Next, it checks whether the entry of the parameter which had the identifier of the data name included in 
R and a same name in the procedure parameter list of the procedure data D related with the next node of the 
procedure node to which performed inspection belongs exists. If it exists, the data with which it corresponds in R 
as a default of the parameter will be set up (procedures 1506-1512). 

[0076] An inspection activation result can be made into the default of the input parameter of other inspection by 
applying to all the procedure nodes after the procedure node to which inspection which performed the above- 
mentioned processing belongs (procedure 1 504). 

[0077] By the system shown with the gestalt of this operation, a security hole diagnostic tool with the following 

descriptions is realizable. 

[0078] First, the attribute name (sort key name) and procedure execution sequence of inspection activation 
means information which are used [ 1 st ] for a classification are given as a procedure definition, and there is the 
description that a user without knowledge can also perform inspection of each [ sequence adapted to general 
attack procedure ] by classifying the inspection item at the time of activation. 

[0079] Furthermore, there is the description of making possible what is visually grasped about whether which 
inspection having been successful in how far the present inspection being conducted for the user, and changing 
the display of the node in a procedure viewing area according to each running state of an inspection item having 
gone wrong. 

[0080] Furthermore, there is the description that it can respond to an addition, deletion, and modification of an 
inspection activation means flexibly by generating dynamically the input screen of each inspection activation 
means and the parameter needed with inspection routine. By editing the inspection activation means stored in 
the inspection activation means storing section 504 before inspection activation, an addition and deletion are 
performed and a change of an inspection activation means is made. 

[0081] Furthermore, there is the description that the data with which an inspection activation means outputs the 
data obtained by the activation result of an inspection activation means by expressing by the list which makes (a 
data name, data type, and a value) one entry can be set up flexibly. 

[0082] Furthermore, there is the description that an input of a user is mitigable by the thing after it automatically 
set up as a default of the input parameter of inspection, about the data of the inspection result acquired in the 
form of the above-mentioned description. 

[0083] With the gestalt 1 of the gestalt 2. above-mentioned implementation of operation, although three kinds of 
screens were shown in the operating set. it is not necessarily restricted to this. This security hole diagnostic 
method may be the case where it has the screen into which a procedure definition file is edited. In this case, 
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beforehand, fundamental inspection routine is displayed and the screen into which a user edits the displayed 
inspection routine is offered. 

[0084] For example, the screen which performs the following modification is offered. 

(1) Change the inspection activation means corresponding to an inspection name (an addition, deletion). 

(2) Change the sequence of inspection of inspection routine. 

(3) Change the sequence of performing two or more inspection activation means to correspond to an inspection 
name. 

You may be modification other than the above. 

[0085] Moreover, it is also possible to offer the screen which changes the default of the executable parameter 
contained in the information on the inspection activation means corresponding to two or more inspection 
activation means of each (inspection execution information) or the item of an executable parameter. 
[0086] 

[Effect of the Invention] According to the security hole diagnostic method concerning this invention, a thing 
without the detailed knowledge about an inspection activation means can also perform inspection. 
[0087] According to the actuation screen of this security hole diagnostic method, the fundamental procedure of 
inspection routine required for a security hole diagnosis can be grasped. 

[0088] According to the actuation screen of this security hole diagnostic method, the inspection activation 
means corresponding to a procedure can be grasped. 

[0089] According to the actuation screen of this security hole diagnostic method, an executable parameter 
required in order to perform a procedure can be grasped. 

[0090] According to the actuation screen of this security hole diagnostic method, the executable parameter for 
which an input is needed can be known, and a required parameter can be inputted by the actuation control 
section. 

[0091] According to the actuation screen of this security hole diagnostic method, the sequence of performing 

the inspection activation means corresponding to each inspection name can be grasped. 

[0092] According to the actuation screen of this security hole diagnostic method, the procedure parameter 

(sum-set of an executable parameter) corresponding to an inspection name can be grasped. 

[0093] According to the actuation screen of this security hole diagnostic method, an executable parameter 

required for an inspection activation means can be grasped. 

[0094] According to the actuation screen of this security hole diagnostic method, from equipment to be 
examined, an inspection result can be acquired and the following inspection activation means can be performed 
using the acquired inspection result. 

[0095] According to this security hole diagnostic method, an inspection result can be displayed. 
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* NOTICES ♦ 

Japan Patent Office is not responsible for any 
damages caused by the use of this translation. 

1 .This document has been translated by computer. So the translation may not reflect the original precisely. 
2.**** shows the word which can not be translated. 
3.1n the drawings, any words are not translated. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[ Drawi ng 1] Drawing showing an example of the whole system of the security hole diagnostic method of the 
gestalt 1 of operation. 

[ Drawin g 2] Drawing showing an example of the configuration of the inspection activation equipment of the 
gestalt 1 of operation. 

[ Drawin g 3] Drawing showing an example of the configuration of the operating set of the gestalt 1 of operation. 
[ Drawin g 4] Drawing showing an example of the format of the procedure definition file of the gestalt 1 of 
operation. 

[Drawing 5] Drawing showing an example of the format of the display name definition file of the gestalt 1 of 
operation. 

[ Drawin g 6] Drawing showing an example of the configuration of the main screen (actuation screen) displayed on 
that of the operating set of the gestalt 1 of operation. 

[Drawing 7] Drawing showing an example of the configuration of the candidate host information input screen 
displayed on the operating set of the gestalt 1 of operation. 

[ Drawin g 8] Drawing showing an example of the configuration of the inspection result display screen displayed on 
the operating set of the gestalt 1 of operation. 

[Drawing 9] Drawing showing an example of the mark which shows the execution information of the inspection 
activation means of the main screen displayed on the operating set of the gestalt 1 of operation. 
[Drawing 10] The flow Fig. showing an example of actuation of the classification procedure (information reading 
phase) of an inspection activation means. 

[Dravying 11] The flow Fig. showing an example of actuation of the initialization procedure (procedure parameter 
generation phase) of the inspection routine information at the time of initialization. 

[ Drawing 12 ] The flow Fig. showing an example of actuation of the initial-screen construction procedure 

(screen-display phase) in the procedure viewing area 401. 

[ Drawing 1 3 ] Drawing explaining the contents of the procedure definition file. 

[Dr awin g 14] Drawing explaining the information on an inspection activation means. 

[ Drawin g 15 ] Drawing explaining the case where information on an inspection activation means is ****(ed) by 
property name "PLUGIN.TYPE". 

[ Drawing 16 ] Drawing explaining the activation parameter list of the information on an inspection activation 
means. 

[ Drawing 1 7 ] Drawing showing an example of actuation of procedure parameter area generation when a user 
chooses a procedure node by the procedure viewing area of the main screen. 

[Drawing 18] Drawing showing an example of actuation of procedure parameter area generation when a user 
chooses a procedure node by the procedure viewing area of the main screen. 

[Drawing 19] Drawing showing an example of the procedure parameter area generated when a user chose a 
procedure node by the procedure viewing area of the main screen. 

[ Drawin g 20 ] Drawing showing an example of actuation of procedure parameter area generation when a user 
chooses the node of an inspection activation means by the procedure viewing area of the main screen. 
[ Drawin g 21] Drawing showing an example of actuation of procedure parameter area generation when a user 
chooses the node of an inspection activation means by the procedure viewing area of the main screen. 
[Drawing_22] Drawing showing an example of the procedure parameter area (before an executable parameter 
setup) generated when a user chose the node of an inspection activation means by the procedure viewing area 
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of the main screen. 

[Prawing 23] Drawing showing an example of the procedure parameter area (after an executable parameter 
setup) generated when a user chose the node of an inspection activation means by the procedure viewing area 
of the main screen. 

[ Drawing 24 ] Drawing explaining the procedure parameter of an inspection parameter area when a user chooses 
a procedure node by the procedure viewing area of the main screen. 

[Drawing 25 ] Drawing explaining the executable parameter of an inspection parameter area when a user chooses 
the node of an inspection activation means by the procedure viewing area of the main screen. 
[ Drawin g 26] Drawing showing an example of the actuation for reusing the inspection result of the inspection 
activation means of 1 to the next inspection. 

[Drawing 27] Drawing showing an example of the actuation for reusing the inspection result of the inspection 
activation means of 1 to the next inspection. 
[Description of Notations] 

103 Network, 104 Host to Be Examined, 200 Operating Set, The 201 screen generation section, 202 A procedure 
definition file. 203 Display name definition file, 204 An actuation control section, 205 A display, 301 Main screen 
(actuation screen). The host information input screen for 302, 303 The inspection result display screen. 401 
Procedure viewing area, 402 An inspection parameter area, 500 Inspection activation equipment, 501 The 
execution control section, 502 The candidate host information storing section, 503 An inspection activation 
means, 504 The inspection activation means storing section, 901-904 Mark showing the activation situation of 
inspection. 



[Translation done.] 



http://www4.ipdl.jpo.go.jp/cgi-bin/tran_web.cgi_ejje 



2004/09/15 



02) ^ fF ^ ^ (A) 



#§12001-337919 
(P2001-337919A) 

(43) B ^^13^12^ 7 0 (2001. 12. 7) 



<5l)Inta.' 
G 0 6 F 15/00 
11/22 



3 3 0 
3 10 



F I 

G 0 6 F 15/00 
11/22 



33 DA 5B048 
31 OR 5B085 



^is* m^m(omo ol (^21 h) 



(2l)tilBS# 


#R2000- 1 53601( P2000- 153601 ) 


(TDtiiiaA 000006013 








(22)milB 


7j£12^ 5 M24B (2000. 5. 24) 


























(74)f«aA 100099461 












P:?"— 5B048 AA18 0C15 DDOS EEDO 






5B085 AC08 CEOl 



(57) C^] 

fmms 0 0 tmcmm 200 t^^iiix., ^m^i^ 
5 0 0{±. MO 4*«^-r?)?^®«^ 

mr^m 5 0 3 ^«IS®ti^*fT^S! 5 0 3 

200 ti(D-< >^yj^—xiit:^m-r^mmms^5 0 

1 1 ^iiix.. 2 0 0 tt, ^^*^ff^S 5 0 0 i: 

^SItMltS»f>^JgSgP 2 0 4 i:. 5 0 3 

S^JH^^T'f ;U2 0 2 a;, tfeft:Si:t^a^^®S 









1 






V 




Is 




A 


i 


r 


1 



1 

cw^3] ±mmmTmiii. ^^^^^ 



(2) #§12 00 1-33 7 9 1 9 

2 

3^^m*^(cI3tt®-^r:^i Ut^^ 5^— >'p^;5^o 

^s^Uff ^ -a- 5 c i: 5&iitmi:-r ssi^ 4 lascD-ir^ 
^m>=z> %M»s ci^-r s**^^-niffs^?&^5!^ 

[If ^7] ±l3tii®^a5(±^ S^ftbfcl^tDl^ 
40 )lS^^^;^-^J'tbT^U :^bfc^Jll/^^;^-^^ 

©S^A;t;b. A;fjbfct^^^@«{c^i$;-r?.^ 
50 /•^^;<-^S:^^>'"?^p<-^5'^(::^^^■r2>»^•^ii^ffiS 



m^ss^mau 20 

CO 0 0 1] 

*)CD-e*?)o - 30 

[0002] 

VSiy—Jl'tL'X^MX.ii^ Internet Secu 
rity S y s t emsttcDl n t e r ne t Sc 
anner-^, 7 U— "CiiiiS^ixTVSne s s u s*s 

[0003] -is. ^{^?fe^*=ff a d t-r-fe^^ro. U 7^ 

;i/(JDtil*<£fT5 ^y— UT, nmap^, Jo 40 
hn the r i p p e r ;i'As?^-r 
So nma p (i^^^;;^ h ±T-^ LTV ^ tf:^ * 
^Hf^-r-SfefeCD*;/— ;i'-e$>t)> John the ri 
p p e r{i/t;^'7— r-f t UTBiS§'&>'^:x 

[0004] 

[^^*s«ISIlb.t^i:-rs^S] U3!)»U ±f3®J;^J& 



(3) #11200 1-337 9 1 9 

4 

[0 0 0 5] J:MU:tcta{::> i:-®aS*T-«A^ns 

[0 0 0 6] AA^omm^-^^-t^tzm:. 

[0007] 

^^§JtWts«f'^ai:, -fe:*^i';7^'r*->»i/<£^ 
[0008] ±I3#JII^«7 r-r^Kl. t^^Mi: U 




(4) #^2 00 1-337 9 1 9 

5 6 

^imif. ^^i■mnz^^i±Ismm^s!&^cm^^ [o o 1 4] ±i^wmsni. ±imB.(D^m7^ 

n^±EmM^myT^ juif^m^T^ m^jhA^fsm m^ssis^iziii^u ±mmm^sss^it. ii^'^pm^ 

[0009] ±mmm^^^^t. im m^^i-^mc^mm^^-r^ c t Sr^t-rso 

MS^j5Sgi5tt> m.mLrz^mmfmmiz^t.ti^^^ [o 0 1 5] ±se^mfmsint. ^mM^mi>i^^ 

CO 0 1 0] ±^smmfT\mit. ^mmf^(om^ m^^ie^mmtT'mt&iM^'mmss^miX^. ± 

gptts ±§3»f^jmi5*^^.ii^$nfe«i^fT^i3ps* CO 0 1 6] jii^fTiijffleiJtt. ^^#@&ffl^^T 

coo 1 1] ±i3«^/'t5p<— mf^^^/— w^\^fz^<Dmmu^m7r<r^^^^^m.m^^ 

gW>r{t fcUff >» ^7 ^ — iJ' 5:_hi^^fTSiJa3lgP--ili:*3 [0017] 

u ±f^l^T»JWgp^i^ ±^!l^'^J^Blffi*»e.lefT>'^^^ so [^^cdiqscd?kj^] igssew^jsi. wt, ^*#fiiu 

[0 0 12] ±ia-tr^j- y^^-f ;i/S^-rs*^ . i^^.T'Mi. tfeiu^^ixx h i o Avznv-c^^:/ vv— 

<5rsgk:^-r5*»Si3^-nifTS^*^i?^ ±S3iBffi^ [o o i s] *s^:^7^Att. «ft«g2 o o. 

s■^■^^^■fn^c»-5v^T. isd^^tmnii^tz^cD [oo 1 9] j^c. ia2^#MU'5:*se>«^iifT«M5 

t ^mmm^^mmcm^s-r^m'^mm^ o o cDm^-^jt-^^v-vTUwg-r ^^mfmm s o 

[0 0 13] ±fsmm^m±s mmi^r^micD^mm 2. ^mn^ms 0 3, ii»ff#^gEtesteP5 0 4x 

ii?T/ cDi*k iifT-r s^«i3Mcs-r-5^o [0020] mmnsm. 5 0 1 tt. si'^^ 2 0 0 a»^> 



[002 1] m^:?^ hmmtmsii 5 o 2{i. »f^«M 

^ M 0 4 CK-rstl^SS^. SiJiD^feWfeSl^fT^fig 

[0 0 2 2] tfe. tllSE^IfT^^St&WgPS 0 4tt. IfflK 

[0 0 2 3] «^^^^CDt^{±, «^^lfT^©5 0 
TV^1^{^J;V^» ti^-oT. :^^fT^@ 5 0 3 C9f*igpJCiB 20 
»&t:4.J:VN„ JiATCittB^T-tt. Ife^lfr^ISS 0 3 CD 

[0 0 2 4]ifeK:s 03*#MU'&A^e.»{^«S2OO 
t30^^Tii^S. Sf^«g2 0 Ott. Hffi^fiEgB2 0 

2 0 3 »f^«ijfflia52 0 4 i:> ^■iT.zrv^ 2 0 5 i: 

r^itSo icDffe. »f^ffjffligP2 0 4ii. o o 

[0 0 2 5] llfS^gi52 0 Itt. ^)lS^«7T'r;i/2 

^V^-C. l^'^fiJmP2 0 4^£:;rhU-Cl^^^®*Si|fla5 
5 0 4iP^t^^|R^©®«^^^fT«^ (^a^ 

U :^Ufc^'^B®<£±f37'^ 2 0 5 

[0 0 2 6] Wff»2 0 Ott. ^iiiSlCioTi^ 

#{c»ft^©^j|#t^^„ «ftiiiffifiJe8ei52 0 4{i. ^ 
liKFf::^|ii««7rf ;u2 0 2. «^S«7 7"f;i/2 

0 3 %:m^ih^&<mi.wm.^^oo 

[0 0 2 7] #Jii^il7r'f;U2 0 2tt. ^ 

©Mstf^ (^^*. P^iJiBj) Str=&^IilS(ct^| 
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^«7T-l';i/2 0 2 giJS:^ UTl^NSo 
[0 0 2 8] *S^^^77-f;U2 0 3tt. iii®±{c^ 

la 5 tt, c (i>m&(mm(Dm.yr^^m-7 ^-r 2 o 3 ® 

[0029] 136 8 tcSf^iH®®— £?!l5r^ UT^'^ 

So 06tt> iora (^'^la®) 3 0 \oy—m^7r^\^-x: 

^^&o ^iBffi3 0 itt, ^^^-^Wr^^^^mwrn. 
«s4 0 1 i:, ^mmy^'^h 0 3T-^-r5lfett>'^^^ 

*(iii®3 0 2cD—^f|JS:^u•rv^So lasji, ^^^mw^ 

^iHffi3 0 3©— 0!)*^UTV%-5o 
[0 0 3 0] ^«^«4 0 Itt, 

[003 1] t^/1vp<— <5'^4 0 2(i. ^JUS^ 
^4 0 1 ±T-3SR^ tL/i r^^Hij ^ < \m^^ 

[0 0 3 2] c:ix^>G^>^iiiS»±, iC^sic/st^-r^^- 
?i56^tvs„ ^>J^::^ht^7o^7iliS3 0 2{i:. 

fr^M 5 0 0 ^<Dnm.it^:^ y>mmm> 502 if tc^sa^ 

^>^^;^^«mx*ii^®3 0 2Sfflv^T«^ 
^s^S^ft^-ri.o t^lft^^a^iii®3 0 3J±, 

[0033] >|i»f^^g 200 cr>ti^•^;)^ffi{::oV^Tfg* 
Cj£E-<5o 2 0 0 §^i!rrs i:. 1^ 6 

t::^$^ns^li(®3 0 lAs^$ft§„ ^ll^^^4 

0 iKtt. ^^^^m^^^m<Dj-Y (*iisy- 

K) A5a^^^^TV^So 

[0 0 3 4] K (^M^- 

jSiUfc/^^^— ^A;tiiiiBAstfefc'^7x<— <5'ffiJ®4 0 2 

ff^/'-^^p^— ^®A;trSi$«-r*)®T-afe-5o ^lHy— 

*S^^®5 0 3*||fTl-sfc«)Jc:'^>5y^^^-^i^ 

:^T^^^*X-i)o 

[0035] ^mmi^m:>j—Y-^mi\^tz}^^m 



^fUT^^<o Hffi^tt, «aa@^«^iliffl3 0 3T-St 
[0 0 3 6] #Jliy-K^&^UTt^4^To}t»&, 

[0 0 3 7] c:ti,6^^#*s$iJfflI-et-5J;^Ct--5fc 
•tf{CFp3V>^fc-a-j ©3aB«A»?>^f SCi:AST-^.2). 

[0 0 3 8] E9tt. mmmizisi-f^i^ssmf^mcD 

[00 3 9] ^<i«^M. O^;^"?— K7r-f;i/j 

[0040] 2^5^;:^5^A®iWt^:iov>Ti5iB^-r 
So ttDtof::, laio, lai iSU^iai 2^#MU^As 

[ 0 0 4 1 ] la 1 o{±, m'Fmmiziiif^^m^^m 

4 0 1 (.mmm-^^m^) 
[0 0 4 2 ] E 1 ott. m^^ji.fffm^^m.i-yti- 

fis m^myr-(Ji^2 O 2S:B^iitr» 
[0043] 04T-tt. ^=^^-S^i^ PLUGIN_ 
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TYPE*— ^JtLT^^UT^^So ^>t. ^4T-{is #^ 

^) > ¥ <llffi^T*fl=> ¥ <PaBUiB§> <l«^T'f3 

[0 0 4 4] iai3{c:, #M^^7y"r;i.CD«fi£®-0iJ 
*^UT^^•2.o ^IBS«7 7"f;KCj±. ±iE<Z)«tC. 

10 SBUMacDgfts-i^ffl^-rso 

[0 0 4 5] lai 3t. tiy'^^)^, mmr^. m 
^im(Dmm:&m^7jk\^x\'^^a 

[0046] ifeKl, 8 0 2 T% ^5!^3i^nfe^Jll«»3i 
« (Map) ^^-rSo Mapt3|&&^^n-S5^— <5' 

20. tt. :i©®pgTfJi^$.s„ 

[0 0 4 7] 8 0 3~8 0 9-C% l«llfi^M5 0 0© 
tfe6l^?T^e*Si&^5 0 4cf^3^&Srt^tVTV^S^T®^t 
^mff^StS 0 3*^?>|fe*||fT^ScDt^Sr5lf#-r5o 

r€>o ass#ufc;=^^— (fir-Ma p^^u m^T^^ 

[0 0 4 8] Hi®*fefiKSP2 0 Hi. ^)1R^«77' 

30 J^m-y-r-i )VX^\t^ "PLUGIN_TYPE" ) ^ 

So iJjJc:, i®®^jgSgB2 0 Itt, »f^$ijfflia52 0 4^:0- 

UT. immmm.^ o o®«^iff^®tsj&^5 o 4 
0 3 t^^n^^(7mmt(D§m^mi^xi'^^^ 

[0049] i^fc:. illS^g|52 0 1 tt. 
SlfT^S!®l^*»e.^dp-^ (CCT-tt, "PLUG 

iN_TYPE" ) izmmT^T'—^cm^m^T^. 
lai 5{c, ^^'®ffi*®^^f■r■5«H^*53^bTv^So 

40 3a'^Ufc7=— <J'®ia*s#)li^^77"f;U2 0 2(fJ 

[0 0 5 0] 5l!3/±i^^^fc^» (cc-c-(i. "PASSW 
ORD_CRACK") ^fclC. ^m^m7 y 2 0 

2i^T-^^-rs:&«fefj7-=fU5&t^rso m^T?>» 

m^ioT--:! >; tc^tfS-r StiiM±0y — KcD^y — h* i: b 

Smitt, tfeKllff*IS®f^<Z^?f«HES ( "NAM 
E" ) yuf'^y-^ mi 5cd:@^±, "j ohn" ) * 

50 [0 0 5 1] 2~5cWig*^S#$nTV^-5>^T®^ 



(' 

11 

[0052] <^eifT*©Ofi^tt, 015 tC^-rO^O 
Stt, "NAME") . ^^-J^^-^U 

(ro/tT^ "PARAMETER") (U 
[0053] ^^l*II^T^@©t^^c^Si^S^®flk®M 1( 

[0 0 5 4] El 6{i. tJ^|^*S!CDf^{3^iiTS 
aj^T'-f^^" PARAMETER" i:-r So Hfr/^^ 

[0055] mcm^^m^mn-r 

[0 0 5 6] Jfet:, lai l^#«gU«tAst,^jiH/^^^- 
[0 0 5 7] 01 l-t?«$ixS7n— 5^-^'-htt2o® 

h bfc;i/— 7^^fiS^nTv^5)o — r^tt i o o 2~ 40 

1 0 1 lT-«$tx-S;W->^$)ti. cn{iMap(*lC!>^ 
•r®#ill7^-<J'{3SoT 1003~1009 ifimff^ti 
5C:t$«bT^r^i>o :^f*1 0 0 6~1 0 0 9T- 

m^fcSoTl 0 0 7~1 008ifimf^ix^:it^m 

[0 0 5 8] 1 00 7T-5lf#^nfe^Z'?^^— ^'J;^ 

^^±^ 1 0 0 8x-^m.$tu m^mt^ 1010 
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1 0 0 8T-||Jfi^ns^Mi:tt, (fBSi^SP 1 1 1 0 0 
7T-9lf#?ixfc||fT>'^7;><— iS"JXh (param_l 
ist) t^OMU P t(ffc:?^b'fevv^^p<— 
5rM-Dfc^> h UA^pa r am_l i s t^lz^:&l^r- 
^iz. ^®ai>h'J^Pt tciiJar S ^ i: ti, 

So 

[0 0 5 9] ±f3i!!M{Cct-DT^^ix5^Jll-'l5'^ — 

[0 0 6 0] ^iz. mi 2^mM\^ts:ifi^mmm7r^^ 
<mmiz-:3i,^xmMi-^o mi 2X'm.^ti^yu—^^ 

— htt2o©4i;<hU&->u— r^SfjEig$iiTVNSo ^ 
£d;i/— 7l±. il02~iiii xm:^n^ju—zr^$> 
So Cin<iMap(*l®^TCD^7=— ^J'JCSoT^ ^ 
^S^m««4 0 l±{c:>— KSr^JSU -e©l*lSPT- 

n 1 0 6~ 1 1 1 o^^-rsr fcT% ^^M^ 

[006 1] {^ffl#*s^^^«|4 0 1 ±<Dy 

J5g5!^S^3•^^^Ti^iHJt-So mi 7. mi 8{±, 
^*S^^4 0 i±«5t^^^:&s-r^— K 

— K) ^^U^y^'bfc:^®*^'?^^— ^$'^«K4 0 2 
®^J5SifflS**-r7D— hT-feSo ^11 2 0 1 

X. -e^^*T-^c:*5^^^^Tv^fcF^gSr^T?iS■rSo 

1 2 02) e e>jtc, D*»e>fiB«B§S9it}mu 

^^-^««»4 0 2±lzm.m-r^ (^Jlil 2 0 3) o 

[0 0 6 2] mm±iz^mT^^m'r^i^:t 

4) o ;*^©jf$«gT-(illfTi^T^*hbT. r—ox 

[0 0 6 3] DA^e,^y-?5^— h-p a:;i 

^^^^7;>i—'$"J:^hPj ^ rpj i:v^^) 
f# (#111 2 0 5) U Pff<Z>&/<-7;>{— ^J'3i> h ijlz 
MU )V-yi 2 0 7~ 1 2 1 5 T-^f&-rS A*ii(®<& 
tfe*/t7^-^«^4 0 2±t^^-rSo 

[0 0 6 4] n 2 0 7~1 2 1 5T-{i> 
tr^OaSfrOo P®iSg(DiSg*P [i] iimmt^ 
diiJc-rSo *-r> ^J©1 2 0 8T-P [i] J:!3/^^^ 
— >^S:aiffU IfeiEZ'?^^— ^S'«J^4 0 2±t«:a^t- 
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:^n^o ^1 2 0 9T-P [i] (Dy'—^mi^m 

[00 6 5] ijU y'-^mifi:iC^¥ik -fe U < it^iSX' 

y'^Ti. V!f^^^i^:^^^^<th (^1 2 1 0) „ 'r^lT. 
h;Jt>y^^;^JC{i. P [i] VzW^^tvrz.7'y*)\yYm±^ 

mm^ti^ (^m 1 2 1 1 ) o 

[0 0 6 6] y^-'S'mifi^^-(i-')X'$>^tcm^ 

■5 (#Jill 2 1 2) o /^^jt—S'^<7mK:^U± 

2 1 3) o S^tc. 7^7*;i/htt*P [i] 
U 5^^^ hdt«>^:7XJC-fe>;/ b-r?) (^JlH12 i4) „ 
[0 0 6 7] JiLhcDiJISfciioT^^nSilia®— 
AS, Ell 9cp®t^^^^-^M^4 0 2-Cfe2.„ ^1 

[0 0 6 8] 02 0, 1212 Itt, 

4 0 l±®«^||ff^©^«-r^-K (t^^Uff^©® 
y-K) ^£<^U>y^bfc«^iD«^^^7^-<J'«JaK4 0 
2CD^fiSS!M^«-r7D— ht?*So ^ilB13 0 

(^jiii 3 0 2) o ifec. Tii}^^mmmmt:m 

»?tiiU ^>'■?^x<-^^^4 0 2±{c:^^-ri) 

1 30 3) o 

[0 0 6 9] 1^2 2K:x "sendmail vul 

n" ©«aE^^®<z)y-K^^bfcfc#(c:> mm 

[0 0 7 0]i>:tc. DipC,««fT^@CD|8fT/'«^X— 
^'jXhPm^lZffb (¥«13 0 4) . WK^-^V^^^ 

^nfcy- h-iosy- KK:Maf^^(t e.tifc^jiBtffffii)^?> 

rPj i:V%a) ?fclS#-r-5 3 0 5) o 

[0 0 7 1] Ur. ^1 2 0 7~1 2 14iim^lZ. 
^IHl 3 0 7~1 3 1 4ttfflS^n2.o ^tOSil 3 1 5 
T% P [i] ^A^pm 

(*)lil 3 1 7) o 

[0 0 7 2] JiLhO^nSK:i^■C^$i^Siil^a®-0|J 
E2 Sft^cOt^-^^^-^^^r-feSo 1^2 2, m 

2 3T-tt, TGU imfiT"^ h USj *sx:*j^© 
^^::&oTV^2,o 132 4C. ^^-K 
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[0 0 7 3] EtC^s-r-tofC. #^JIi-'^^p<-<S'li, ^ 

-Pit. ^^fT^®<Z)««{C^*n5SlfT^'?7^-^'>J 

10 ^i^nfeS^tt, 02 5tr33^^J;dK:, ^mimy^mz 

[0 0 7 4] g^^. ;gl*llfTi^^^flfecDt^cDA:^;>'^ . 
^^—'}'<D9'7^;Uhmtir^^lZ-z>\,^X.m2 6, 

Srig-r. 15 0 IT-tfeSS:^^, mi'^mmH^mmn 
^^^) <&5lf#-r^ mM 1 5 0 2) o 

[0 0 7 5] }kiz. mff vtdmcom-r^^m^-i'cD 
Ml i: UT R 'p(Dmm-r 55=-^' sisis-r (^jih 1 s 

0 6~1 5 1 2) o 

[0 0 7 6] ±mm^mfi^tz^(Dmm-t^mRy 

fiii:-ri)Ci:*^T-#-5 (^ilS1 5 0 4) „ 
[0077] *^(Z)?|^«re:^^ At: i »3 , 

[0 0 7 8] ^T. fHii^. ^i^mmr^^^mf^ 

iScD»vMgfla#T-*s -figfi<j^^^Jil{c:ipufcjilll?T- 
[0 0 7 9] MJC, t^:HBC>&llfTtt.^JSDT^ 

ifi. md^ifiif^^x^t>tix^^?><Dtf^. ircDt^As 
figx;bu ^i.rz(DifiK:m\.x^m}i::tRmr^ 

c: ^ qrtgt -r t ^ ^ i^A^fe 5 , 

[0 0 8 0] Sic. #tfe*ll^T^^s> RxmA^mx'£> 

50 tt, tfe^fTBJjtCtfeSllfT^Ste^ 5 0 4 iztm^ti 
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[008 1] stc, ^^^m(Dm^f^iz^m^ 

■r?>7'-^^§mizm^X'§?>iiu^i^mfi$,ho 
[0082] stc. ±t?^m^Ax-m^:^titz^^$ 

[0083] m§mi-m2. i^^s&comm i xit. m lo 

S7 r -f ^I'tr^-r SSiffi^llx. S^^T^ ■:5 T <t 

[0 0 8 4] ifecj^afessss^fT-rsisss 

(1) ^^^ztmt^^immy^m^^ (iiio. gij 

(2) ^^JIi®^CDJIl#$^-r-So 20 

(3) ^^\::nm-^^(v^mf^m^m7r^ 
[0085] ^fe. mmco^m^^m^ti'^nvimS' 

o:^ a SHB^JiW-r S Cl i: oTigT-* -So 

[0086] 

[0087] Cl®-b^jL U 

[0088] ccD-fe:^^ i; ¥-^-t^—jumm:&^(Dm(^ 

[0 089] CCD-fe^jL U ;L^»f:?^iC®igfW 
^Sffia^2.Ci:As-r-^5>o 40 

[0090] :i©-fedpi ^)y^^Tf—)vwmy5^(Dm'm 

[0 0 9 1] w®-b^jL 'Jt^-i-jIx— ;i/^:3jiCO»f« 
[009 2] ^®-fe^;i u 7^^- yi-^—jumi:^^(Dtmm 
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[00 93] C10-fe:^i 0 y-^ ■!i->.—)\^WSCf5^(D^'m 
[0094] dCD-tr^ JL 'J ;i/^;^5?;cD^tlli 

[0 09 5] :l(0-\l^3. U 
[iaffi®ffi#'&aJiB^] 

[B 1 ] iQScDff^^ 1 ®-lr JL i; 7^ -r" Jf:— ;i/^»f*5C 
[1212] ^£D?^SSlc?)tfeeifT^a®^O-0tJ* 

[03 ] ^©jf^^ 1 am'mm.oyimso-m^TT^r 

[04] HJEcb^gSg 1 (om^my ^-f ;i/®S5tcD— 

[0 5 ] 1 jv(Dm^(D 

[0 6 ] m&mi-m i cDj«ft»gcD{c«^$tts^ 
s (^-wi®) ®«5£cD— e^js^-r^o 

[0 8 ] rnmcmm i ®^t^M(ca^$ ti^^i^^ 
[0 9 ] m^mm 1 fZ)^tsg(c^^$ti-5iiiis 
0. 

[010] ^^m7^^(D^^m (.mm^ii^ 

Pi) ©iWtO^JSr^-r^D— 0o 

[011] wmtmizisif^^^mmsicrmm^i:^ 



[012] ^jiB*^^4 0 1 Kiiufhwmmmmm 

[013] ^Jlll^a7 7'-1';KDf*l^^|5JB^-r-50o 

[014] ^^mj^mtD^^mBM-rhm. 

[015] i^mff^^(VmSit:y'a/^y''(^" Pla 
U G I N_T YP E" T-^-r i.:®^*liB§-r S 0o 

[016] immf^m<Dms.<Dmf^ ^ ^ 
[017] ^mma^mwmmx-mmmifi^my' - 

[018] ^mmcD^mmTTmmx-mmmifi^my - 

tf!l<&^1-0o 

[019] iiii[icD^Ma^JST-*iJffl#*s^|iiy - 
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[^2 2] ^Mm(D^mwvmm-r:mm^^^smf 
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[^26] -<7y!^mn^m(D^^^m^ik(D^iz 

103 ^-vh '7—^:7, 104 tfe*«^:^;^h. 2 0 

0 ^•^sg. 2oi®ffi^j5^ 2 02 ^m^my 

10 T-f;K 20 3 «^^m7T-f;k 204 Jgf^J 
205 T^-rXT'lx-f > 30 1 ^iii® (^^i® 
®) > 3 0 2?^*::^MS^A:t»iira. 303 
«^5^@rS^ 4 0 1 ^mm^m. 4 0 2 tfe*/'?^ 

5 00 ^i^ff^S. 

^ 5 02 >t^m5^;^ hfS«l§«ias. 

^S!. 504 ^^mff^mmsk 



5 0 1 mmfm 

5 03 

9 0 1~9 04 



mil 



[135] 





































200 




500 




SOS 



cosi 

SOLARia^ - Solaris 2.6 
\Mndim-9NT.4-0 = Wndowa hTT 4.0 

I ri n' i' y — \ 4 r fffT 

[CPU] 

INTELJ80386 ° tntd ISQxSG 
SPARC = Sim SPARC 
PAJOSC = HP PA-MSC 

[PARAM] 

SCANJ2ANGB = * -KJt*^>«5a 
TARGCT FILE = ^^-rSTT^fr 
PASSWORDJ^ = /^•XT-KW/*' 
TARGBr>VCCOl^= m^^7il9yh% 



^200 



201 



z 



204 



500 



[09] 



901 
902 
903 
904 



(1 1) 



i^gi 2001-337919 



[017] 



501 



200 



503 



^502 



^600 





• 4 






n— K j 




503 










soT^ 







^^ID3 



I 



^104 



St#=> D 



1205 



P:=DlC|MA*n*:^« 



1-1 



1201 



. 1202 



1203 



1204 



. 1206 



202 



a 

©PROPERIYNAME 
4«S'^-* «PLUCIK.TVrPE 

n 

# SYNTAX: 

CATECORy.KEV'^'CATECORYJJISPLAYJWMBOnsX^ 
U EXECLTYFE » 0(be)/AaD/Q(iiery) 



[^15] 





-NAME- 


*STR* 








'STR' 


-PASSWORD.CRACK- 











m2 01 



~r 



Pm D]&'b&^i^^ 



i:=l 



^1301 

^1302 
^1303 

^1304 

^1305 
^1306 



T'—^em. = -PASSWORD.CRACFC 




m7i 
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liaA]l/2000 
I1QA31/2000 

[1B/D1/20Q0 
[laUI/^DOO 
[iat)1/20OD 
[1M1/2000 
[1B/D1/20D0 
[1B/D1/2000 

lia/D1/2D0Q 
[T&tl1/2G00 
[1B/1D1/2000 
iat)1/^DDD 

: latn/^ooo 

; 18/01/2000 
i [184)1/2000 



15:18:05] — ??<Jlffl*i3S«^*S ~ 
15:18:051 aHacl^^^StP^dS 
15:18:05] TAR9ET_nLE = Vetc/pass««r 
15:18:06] 04??J 

15:16:06] TARSET HLE = I C:rrEMP?crk25 J 
15:10:06] 

15:18:321 john^fti^^fftS 

15:18:321 PASSWORD^FILE = ( C:^fTemp»crk25 J 
15:18:321 TAR GET. ACCOUNT = 'roor 
15:1B:3Z)S£^ 
15:18:321 ACCX^UNT.UST 
15:1B:32I | 10] 

15:18:32} | I ACCOUrfT = "roor 
15:18:321 I I PASSWORD = '-root-" 
15:18:32) 



[014] 




1 "NAME" 1 


•STR* 1 "phn" 1 






•Snr 1 "VASSSWOHD.CRACK- 1 




1 :;rxi^y^^^ 1 


T'—^m 1 is 1 



[1212 4] 
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[010] 



801 



803 



804 



Map := ^(IftE^r-^y^ 



802 



key := ^V^.^I^^t^A' 



i := 1 




(15) 



2001-337919 



[@1 1] 



i:=l 



1001 



no 




1002 



list :- Mapl*5«OiS g <rS«t$*bJt 



1003 



j:=l 

31 



1004 



#IK^<77»— ^y^h Pt := * 



1005 




1006 



no 



pararajist :=mB KSEM^il.-CV ViS 



1007 



1008 



1010 



Pt:=Pt U pararajist 












r 


i := 


i+ 1 






1011 





1009 



1 
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